It covers due diligence before contracting, risk tiering, contract terms, ongoing monitoring, review of vendors' assurance reports and exit planning. DORA and NIS2 turn much of it into legal obligations for regulated entities.
The vendor SOC 2 review checklist covers one of its most common tasks.
Read more
Related terms
- Subservice organization
- A subservice organization is a vendor that performs part of the service a SOC report covers, such as a cloud hosting provider or a managed database service.
- DORA
- DORA is the EU Digital Operational Resilience Act, which sets ICT risk, incident, testing and third-party risk requirements for financial entities.
- Register of information
- The register of information is the record DORA requires financial entities to keep of every contractual arrangement with an ICT third-party service provider.